I85PREP
⌘ K
PECB DORA Foundation study materials
PECB DORA Foundation study resources

PECB DORA Foundation practice questions

One question at a time. Build your PECB DORA Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts of ICT risk management and digital operational resilience

Under DORA, which statement best describes the relationship between ICT risk management and digital operational resilience?

  1. ICT risk management applies only to third-party providers, while digital operational resilience applies only to internal staff.
  2. ICT risk management is the ongoing process of identifying and mitigating technology-related threats, while digital operational resilience is the resulting ability to withstand, adapt to and recover from disruptions. Correct answer.
  3. Digital operational resilience is a one-off certification that entities obtain after completing a single risk assessment.
  4. Digital operational resilience replaces ICT risk management entirely, so financial entities no longer need to maintain a risk management framework.

Explanation

DORA treats ICT risk management as a continuous governance and control process covering identification, protection, detection, response and recovery. Digital operational resilience is the outcome of that process: the capability to keep critical functions running and recover quickly when ICT disruptions occur. The two concepts are complementary rather than substitutes.

Question 2Fundamental concepts of ICT risk management and digital operational resilience

A financial entity's management body is setting up its ICT risk management framework under DORA. Which responsibility belongs to the management body itself rather than being delegated to the ICT function?

  1. Executing penetration tests on internet-facing applications.
  2. Performing daily log monitoring on production servers.
  3. Defining, approving and overseeing the ICT risk management framework and the entity's digital operational resilience strategy. Correct answer.
  4. Configuring firewall rules for the corporate network.

Explanation

DORA places ultimate accountability on the management body, which must define, approve, oversee and periodically review the ICT risk management framework and the digital operational resilience strategy. Operational tasks such as log monitoring, penetration testing and firewall configuration are executed by staff or functions under that framework.

Question 3Fundamental concepts of ICT risk management and digital operational resilience

Which element is a core component of an ICT risk management framework as required by DORA?

  1. A customer complaints handling procedure for retail banking.
  2. A recruitment policy for temporary administrative staff.
  3. A marketing plan for promoting new digital products.
  4. A digital operational resilience strategy that sets out how the entity maintains resilience objectives. Correct answer.

Explanation

DORA requires the ICT risk management framework to be supported by a digital operational resilience strategy that explains how the framework is implemented and how resilience objectives are achieved. Marketing plans, complaints procedures and general recruitment policies are outside the required ICT risk framework components.

Question 4Fundamental concepts of ICT risk management and digital operational resilience

In DORA terminology, what does an 'ICT-related incident' refer to?

  1. A scheduled maintenance window announced in advance.
  2. A single or series of linked events that adversely impact the network and information systems supporting business processes. Correct answer.
  3. A business decision to retire a legacy application.
  4. Any planned software release that changes system functionality.

Explanation

DORA defines an ICT-related incident as a single event or a series of linked events that adversely affects the confidentiality, integrity or availability of network and information systems. Planned releases, scheduled maintenance and deliberate retirement decisions are managed changes, not adverse incidents.

Question 5Fundamental concepts of ICT risk management and digital operational resilience

An entity is classifying an ICT incident to decide whether it must be reported to the competent authority. Which criterion is relevant under DORA?

  1. The number of clients affected and the duration of the incident. Correct answer.
  2. The colour scheme used in the incident dashboard.
  3. Whether the incident occurred on a Monday or a Friday.
  4. The seniority of the employee who first noticed the incident.

Explanation

DORA requires classification of ICT-related incidents using criteria such as the number of clients or counterparties affected, the duration, the geographical spread, data losses, and the criticality of affected services. These criteria determine whether the incident is major and reportable. Internal presentation details or the day of occurrence are irrelevant.

Question 6Fundamental concepts of ICT risk management and digital operational resilience

Which statement correctly describes the scope of DORA's ICT risk management requirements?

  1. They apply only to entities operating exclusively outside the European Union.
  2. They apply only to ICT third-party providers, not to financial entities.
  3. They apply only to credit institutions with more than 500 employees.
  4. They apply to a broad range of financial entities, including credit institutions, payment institutions and investment firms. Correct answer.

Explanation

DORA applies to a wide set of financial entities listed in the regulation, including credit institutions, payment institutions, investment firms, insurance undertakings and others. Size thresholds are not the basis for excluding entities from the ICT risk management obligations, and the rules target financial entities as well as their critical ICT providers.

Question 7Fundamental concepts of ICT risk management and digital operational resilience

What is the purpose of the proportionality principle in DORA's ICT risk management requirements?

  1. To let entities choose which incidents they report based on cost.
  2. To exempt small entities from having any ICT risk management framework.
  3. To allow the ICT risk management framework to be proportionate to the entity's size, risk profile and the nature and scale of its services. Correct answer.
  4. To allow entities to ignore third-party ICT risks if they are small.

Explanation

DORA explicitly requires the ICT risk management framework to be proportionate to the size, business profile and risk exposure of the financial entity. Proportionality tailors the sophistication of controls and governance; it does not remove the obligation to have a framework or to manage third-party risk.

Question 8Fundamental concepts of ICT risk management and digital operational resilience

Which of the following best describes 'ICT risk' as used in DORA?

  1. The financial loss caused exclusively by market movements in traded securities.
  2. Any reasonably identifiable circumstance relating to the use of network and information systems that, if it materialises, may compromise the security of those systems or the data they process. Correct answer.
  3. The legal risk arising from an employment dispute with a former contractor.
  4. The reputational risk of a poorly received advertising campaign.

Explanation

DORA frames ICT risk in terms of circumstances linked to the use of network and information systems that could compromise security or the data processed. Market, employment and advertising risks are other risk categories that may interact with ICT risk but are not themselves ICT risk.

Question 9Fundamental concepts of ICT risk management and digital operational resilience

A bank wants to strengthen detection of anomalous behaviour across its critical systems. Which capability aligns with DORA's detection requirements?

  1. Removing all logging to reduce storage costs.
  2. Disabling automated alerts so staff are not distracted.
  3. Relying solely on annual self-assessments to detect incidents.
  4. Deploying monitoring and alerting mechanisms that identify anomalous activities, including network performance issues and ICT-related incidents. Correct answer.

Explanation

DORA requires entities to have mechanisms to promptly detect anomalous activities, including network performance issues and ICT-related incidents, and to have multiple layers of control and alerting. Removing logging or disabling alerts undermines detection, and annual self-assessments are far too infrequent to serve as the primary detection mechanism.

Question 10Fundamental concepts of ICT risk management and digital operational resilience

An entity is documenting its business continuity arrangements under DORA. What must its ICT business continuity policy specifically address?

  1. How the entity will choose its external auditor for financial statements.
  2. How the entity will restore the availability and integrity of critical operations and data after an ICT disruption. Correct answer.
  3. How the entity will select new marketing channels for its products.
  4. How the entity will negotiate salaries with its employees.

Explanation

DORA requires an ICT business continuity policy that describes how the entity restores the availability and integrity of its critical operations and data after disruption, including through backup and recovery measures. Marketing, salary negotiation and financial audit selection are unrelated to ICT continuity.

Question 11Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is testing its ICT business continuity arrangements. Which practice best reflects DORA expectations?

  1. Running scenario-based tests, including cyber-attack and switchover scenarios, and involving staff and third parties as appropriate. Correct answer.
  2. Testing only the disaster recovery site's air conditioning.
  3. Delegating all testing to the marketing department.
  4. Testing only once at the time of system deployment and never again.

Explanation

DORA expects entities to test their ICT business continuity arrangements regularly using appropriate scenarios, including cyber-attacks and switchover to backup facilities, with lessons learned fed back into the plans. One-off testing and testing irrelevant facilities do not demonstrate resilience.

Question 12Fundamental concepts of ICT risk management and digital operational resilience

An entity is defining its backup policy under DORA. Which approach is most consistent with the requirements?

  1. Store the only backup on the same server as the production data.
  2. Keep backups unencrypted to speed up recovery.
  3. Never test restoration to avoid disrupting production.
  4. Maintain backups that are segregated from the primary systems, protected against compromise, and tested for restoration. Correct answer.

Explanation

DORA requires backup policies that specify the scope and frequency of backups and require restoration testing, with backups segregated and protected so they are not compromised by an incident affecting production. Keeping the only backup on the production server or leaving it unencrypted undermines recovery and confidentiality.

Question 13Fundamental concepts of ICT risk management and digital operational resilience

Which statement best captures the 'lessons learned' element of DORA's incident management process?

  1. The entity removes the incident from its records to avoid regulatory scrutiny.
  2. The entity archives the incident report and takes no further action.
  3. After an ICT-related incident, the entity reviews root causes and strengthens controls and processes to reduce the likelihood or impact of recurrence. Correct answer.
  4. The entity blames the individual who reported the incident.

Explanation

DORA requires post-incident reviews to identify root causes and to implement improvements to controls, policies and procedures. This learning loop is what turns incident handling into strengthened resilience. Archiving without analysis, deleting records or blaming reporters defeats the purpose.

Question 14Fundamental concepts of ICT risk management and digital operational resilience

An entity is selecting an ICT third-party provider for a critical function. Which DORA-aligned consideration should drive the decision?

  1. The provider's office location having the best view of the city.
  2. The provider offering the lowest price irrespective of security.
  3. The provider being a personal acquaintance of a board member.
  4. The provider's ability to meet the entity's resilience and security requirements, including service levels and exit arrangements. Correct answer.

Explanation

DORA requires due diligence on ICT third-party providers that considers security, resilience, service levels, subcontracting and exit strategies, particularly for critical functions. Price alone, personal connections or irrelevant office features do not satisfy the due diligence obligation.

Question 15Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is drafting a contract with an ICT third-party provider supporting a critical function. Which contractual element does DORA require?

  1. A clause exempting the provider from all confidentiality obligations.
  2. A clause allowing the provider to change service terms unilaterally without notice.
  3. Clear service level descriptions and provisions on the provider's obligations to assist with incident response and audits. Correct answer.
  4. A clause prohibiting the entity from ever terminating the contract.

Explanation

DORA specifies required contractual elements for ICT third-party arrangements, including service level descriptions, audit and access rights, incident support, and termination and exit provisions. Unilateral change rights, prohibition on termination and blanket confidentiality exemptions are inconsistent with these requirements.

Question 16Fundamental concepts of ICT risk management and digital operational resilience

What is the role of the Register of Information in DORA's third-party risk framework?

  1. It is a register of marketing campaigns planned for the year.
  2. It is a list of employees authorised to use the internet.
  3. It records all contractual arrangements with ICT third-party providers and supports supervisory oversight of those arrangements. Correct answer.
  4. It is a register of customer complaints about digital services.

Explanation

DORA requires financial entities to maintain a Register of Information covering all contractual arrangements with ICT third-party providers, which competent authorities use for oversight. It is not a staff list, a complaints log or a marketing plan.

Question 17Fundamental concepts of ICT risk management and digital operational resilience

Which of the following is an example of an ICT-related incident rather than a mere event?

  1. A scheduled network upgrade completed without issues.
  2. A planned database migration announced to users in advance.
  3. A routine software update deployed during a planned maintenance window.
  4. A ransomware attack that encrypts production databases and disrupts customer transactions. Correct answer.

Explanation

An ICT-related incident adversely affects the confidentiality, integrity or availability of systems or data; a ransomware attack that disrupts transactions clearly meets this definition. Planned updates, upgrades and migrations are controlled changes that do not, by themselves, constitute incidents.

Question 18Fundamental concepts of ICT risk management and digital operational resilience

An entity is establishing its ICT risk management governance. Which arrangement best reflects DORA's expectations for the three lines of defence?

  1. Internal audit reports only to the ICT operations team it audits.
  2. The risk management function performs the operational tasks it is meant to oversee.
  3. All ICT risk responsibilities are assigned to a single external consultant.
  4. Operational management owns ICT risks, a risk management function oversees them, and internal audit provides independent assurance. Correct answer.

Explanation

DORA expects a clear allocation of responsibilities consistent with the three lines of defence: operational units own and manage risks, an independent risk management function oversees them, and internal audit provides independent assurance. Concentrating responsibilities in one external party or having audit report to the audited team breaks independence.

Question 19Fundamental concepts of ICT risk management and digital operational resilience

Which statement correctly describes DORA's approach to ICT risk management for the entity's own ICT assets?

  1. Entities may rely on memory rather than records to identify their systems.
  2. Entities need only track hardware purchased in the current year.
  3. Entities must maintain an up-to-date inventory of ICT assets and map their dependencies on critical functions. Correct answer.
  4. Entities are not required to know which systems support critical functions.

Explanation

DORA requires entities to identify and document ICT assets, business functions and dependencies, including mapping which systems support critical or important functions. A current inventory and dependency mapping underpin risk assessment, continuity planning and incident response.

Question 20Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is assessing the potential impact of an identified ICT risk. Which factor is most relevant to determining its severity?

  1. The criticality of the affected business functions and the potential for data loss or service disruption. Correct answer.
  2. The length of the risk register document.
  3. The number of meetings held about the risk.
  4. The font used in the risk assessment report.

Explanation

Risk severity depends on the likelihood of the risk materialising and the impact on critical functions, data and clients. Factors such as meeting frequency, document length or formatting do not affect the actual severity of an ICT risk.

Question 21Fundamental concepts of ICT risk management and digital operational resilience

DORA requires entities to have a digital operational resilience strategy. Which content is most consistent with that requirement?

  1. A list of employee birthdays and office events.
  2. A summary of the entity's advertising budget.
  3. A description of how the entity implements the ICT risk management framework and achieves its resilience objectives, including tolerance for disruption. Correct answer.
  4. A copy of the entity's travel expense policy.

Explanation

The digital operational resilience strategy explains how the ICT risk management framework is applied and how resilience objectives are met, including the entity's tolerance for disruption of critical functions. Unrelated administrative content does not satisfy this requirement.

Question 22Fundamental concepts of ICT risk management and digital operational resilience

An entity is mapping ICT risks to its critical functions. Which approach best reflects DORA's emphasis on protecting critical or important functions?

  1. Treating all systems as equally critical so no prioritisation is needed.
  2. Excluding third-party dependencies from the analysis.
  3. Focusing only on systems used by senior management.
  4. Identifying the ICT systems and third-party dependencies that support each critical function and assessing the impact of their disruption. Correct answer.

Explanation

DORA requires entities to identify critical or important functions and understand the ICT systems and third-party dependencies supporting them, so that controls and continuity arrangements can be prioritised accordingly. Treating everything as equally critical, ignoring third parties or focusing only on senior management systems fails to reflect actual dependencies.

Question 23Fundamental concepts of ICT risk management and digital operational resilience

An entity has experienced a major ICT-related incident and must decide on its reporting obligations under DORA. Which sequence best reflects the expected approach?

  1. Classify the incident against the major incident criteria, then notify the competent authority within the required timeframes and provide updates. Correct answer.
  2. Wait until the annual report is published before mentioning the incident.
  3. Report only if the incident is covered by the media.
  4. Notify customers first and never inform the competent authority.

Explanation

DORA requires entities to classify ICT-related incidents and, where they qualify as major, to notify the competent authority within prescribed timeframes and provide subsequent updates. Reporting is not contingent on media coverage, and delaying until the annual report or omitting authority notification breaches the obligation.

Question 24Fundamental concepts of ICT risk management and digital operational resilience

An entity is considering the interaction between DORA's ICT risk management requirements and its existing operational risk framework. Which statement is most accurate?

  1. ICT risk management can be fully outsourced to an ICT provider with no internal oversight.
  2. ICT risk management should be integrated into the overall risk management framework rather than treated as an isolated compliance exercise. Correct answer.
  3. ICT risk management must be kept entirely separate from all other risk disciplines.
  4. ICT risk management only matters during regulatory inspections.

Explanation

DORA expects ICT risk to be embedded within the entity's overall risk management and governance, reflecting the fact that technology risk affects many other risk categories. Treating it as isolated, inspection-only or fully outsourced without oversight undermines the framework's effectiveness.

Question 25Fundamental concepts of ICT risk management and digital operational resilience

A financial entity relies on a critical ICT third-party provider that subcontracts part of the service. Which DORA-aligned concern should the entity address in its oversight?

  1. Understanding and managing the risks arising from subcontracting chains that could affect the resilience of the critical function. Correct answer.
  2. Ignoring subcontracting because the contract is with the primary provider only.
  3. Assuming subcontractors are automatically compliant without any assessment.
  4. Requiring the provider to keep subcontracting secret from the entity.

Explanation

DORA requires entities to understand and manage risks from subcontracting chains, since a failure deeper in the chain can still disrupt the critical function. The entity remains responsible for oversight, cannot assume compliance without assessment, and should have visibility of subcontracting arrangements rather than concealing them.

Question 26Fundamental concepts of ICT risk management and digital operational resilience

Under DORA, which outcome is the central aim of digital operational resilience?

  1. Building the ability to withstand, respond to and recover from ICT disruptions Correct answer.
  2. Eliminating all reliance on external ICT providers
  3. Transferring ICT losses to insurance markets
  4. Guaranteeing that an entity never suffers an ICT disruption

Explanation

Digital operational resilience is about the capacity to withstand, adapt to and recover from ICT-related disruptions, keeping critical functions running. It accepts that disruptions will occur and focuses on preparation and recovery rather than on impossible guarantees.

Question 27Fundamental concepts of ICT risk management and digital operational resilience

Which pairing correctly matches a DORA ICT risk management component with its purpose?

  1. Detection: restoring data from backups after an outage
  2. Recovery: scanning for vulnerabilities before deployment
  3. Protection: determining which incidents must be reported to authorities
  4. Identification: mapping ICT assets and functions to understand exposure Correct answer.

Explanation

The identification pillar is about knowing your ICT assets, dependencies and business functions so exposure can be understood and managed. The other pairings mix the purpose of one pillar with the label of another.

Question 28Fundamental concepts of ICT risk management and digital operational resilience

What does DORA mean by an 'ICT-related incident'?

  1. A single ICT event with no effect on services
  2. An ICT-related occurrence that disrupts or degrades services, with actual adverse impact Correct answer.
  3. A near miss that was logged but caused no disruption
  4. Any planned change to the ICT production environment

Explanation

An ICT-related incident is an occurrence in the network or information system that has an actual adverse effect on the security of the network and information systems. A mere event may be harmless, and the distinction turns on the adverse impact.

Question 29Fundamental concepts of ICT risk management and digital operational resilience

Which statement best describes the role of the management body in DORA's ICT risk management framework?

  1. It delegates all ICT risk decisions to the external auditor
  2. It approves each individual software patch before release
  3. It defines, approves and oversees the ICT risk management framework and bears ultimate responsibility Correct answer.
  4. It personally performs penetration tests on critical systems

Explanation

DORA places ultimate responsibility for ICT risk management on the management body, which must define and approve the framework and oversee its implementation. Operational tasks are delegated, but accountability at the top remains.

Question 30Fundamental concepts of ICT risk management and digital operational resilience

Which element is a core part of the ICT risk management framework that DORA requires an entity to maintain?

  1. A list of all employees' personal social media accounts
  2. A public marketing plan for ICT services
  3. A strategy, policies and procedures documenting how ICT risk is managed Correct answer.
  4. A catalogue of competitors' ICT suppliers

Explanation

DORA requires a documented ICT risk management framework comprising strategies, policies, procedures, protocols and tools. This documentation must be proportionate and reviewed regularly.

Question 31Fundamental concepts of ICT risk management and digital operational resilience

What does DORA require regarding the review and updating of the ICT risk management framework?

  1. It must remain unchanged for five years to ensure stability
  2. It must be rewritten from scratch every month
  3. It must be reviewed only when a supervisory authority issues a fine
  4. It must be reviewed at least once a year and after major incidents or significant changes Correct answer.

Explanation

The framework must be reviewed at least annually, and also following significant incidents or changes to the operating environment. This keeps the risk assessment current as threats and systems evolve.

Question 32Fundamental concepts of ICT risk management and digital operational resilience

Which capability is central to the detection pillar of DORA's ICT risk management?

  1. Designing the corporate logo and branding
  2. Detecting anomalous activities and ICT incidents through continuous monitoring Correct answer.
  3. Preparing annual financial statements
  4. Concluding outsourcing contracts with cheaper providers

Explanation

The detection pillar requires mechanisms to promptly identify anomalous activities, including network and system monitoring and alerting. It is about timely awareness of incidents rather than commercial or financial activities.

Question 33Fundamental concepts of ICT risk management and digital operational resilience

Which statement best reflects DORA's view of ICT risk within an entity's overall risk landscape?

  1. ICT risk is a narrow technical concern handled only by the IT helpdesk
  2. ICT risk is a subset of operational risk that must be managed across the organisation Correct answer.
  3. ICT risk only matters for entities that sell software
  4. ICT risk is identical to credit risk

Explanation

DORA treats ICT risk as a component of operational risk, managed holistically and linked to business functions across the organisation. It is not confined to a single technical team or product line.

Question 34Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is classifying an ICT risk by its potential impact. Which factor most directly reflects the severity of that impact?

  1. The colour scheme of the risk register
  2. The name of the analyst who logged the risk
  3. The version number of the risk management software
  4. The number of customers affected and the duration of disruption to critical services Correct answer.

Explanation

Impact severity depends on substantive factors such as how many clients are affected, how long critical services are down, and the extent of data or financial loss. These determine how serious the consequence would be.

Question 35Fundamental concepts of ICT risk management and digital operational resilience

An entity is deciding how much detail its ICT risk management arrangements should contain. Which approach is most aligned with DORA's proportionality principle?

  1. Base the level of detail solely on the number of IT staff employed
  2. Apply identical controls to every entity regardless of size
  3. Exempt small entities from any ICT risk documentation
  4. Scale the arrangements to the entity's size, risk profile and the nature of its services Correct answer.

Explanation

Proportionality means the framework's sophistication should match the entity's size, business profile and risk exposure, while still meeting the core requirements. It is not a blanket exemption for smaller entities.

Question 36Fundamental concepts of ICT risk management and digital operational resilience

During a risk assessment, a team finds that a critical payment system depends on a single unpatched server. Which DORA-aligned action should follow?

  1. Treat it as an identified ICT risk and apply mitigation such as patching or redundancy Correct answer.
  2. Wait for a supervisory authority to order remediation
  3. Record the finding and take no action until the next annual review
  4. Remove the system from the asset inventory to avoid scrutiny

Explanation

Identified exposures must feed into the risk management process and be mitigated in line with the entity's risk tolerance. Patching or adding redundancy addresses the single point of failure.

Question 37Fundamental concepts of ICT risk management and digital operational resilience

An entity wants to ensure its ICT risk management covers the full lifecycle of ICT systems. Which practice best supports this?

  1. Ignoring legacy systems because they are old
  2. Integrating risk considerations from acquisition and development through operation and retirement Correct answer.
  3. Assessing risk only at the initial procurement stage
  4. Managing risk only after systems are decommissioned

Explanation

Lifecycle coverage means risk is considered at acquisition, development, operation, maintenance and decommissioning. Legacy systems in particular remain in scope while they support critical functions.

Question 38Fundamental concepts of ICT risk management and digital operational resilience

Which statement best explains why DORA links ICT risk management to business continuity?

  1. Because disruptions to ICT can interrupt critical business functions that continuity arrangements must protect Correct answer.
  2. Because continuity planning replaces the need for any ICT controls
  3. Because business continuity is a marketing exercise
  4. Because continuity is only relevant to physical fire safety

Explanation

ICT underpins critical functions, so disruptions to ICT translate directly into business disruption. DORA therefore ties ICT risk management to business continuity so critical services can keep running or be restored.

Question 39Fundamental concepts of ICT risk management and digital operational resilience

An entity is setting up its ICT risk governance. Which arrangement best reflects DORA's expectations for clear accountability?

  1. A single committee with no defined roles for ICT risk
  2. Clearly defined roles and responsibilities, including a control function for ICT risk independent of operational IT Correct answer.
  3. Assigning ICT risk responsibility to the marketing department
  4. Outsourcing all governance decisions to the ICT provider

Explanation

DORA expects a clear three-lines-of-defence style structure, with an independent control function overseeing ICT risk alongside the operational teams. Defined roles prevent gaps and conflicts of interest.

Question 40Fundamental concepts of ICT risk management and digital operational resilience

Which statement correctly describes the relationship between DORA's ICT risk management requirements and an entity's existing operational risk framework?

  1. DORA replaces operational risk management entirely
  2. DORA forbids entities from having any operational risk framework
  3. DORA's ICT risk requirements should be integrated into the broader operational risk framework Correct answer.
  4. DORA applies only to entities with no operational risk function

Explanation

ICT risk is a component of operational risk, so DORA's requirements are meant to be embedded within, not detached from, the existing operational risk framework. Integration avoids duplicated or conflicting controls.

Question 41Fundamental concepts of ICT risk management and digital operational resilience

What is the purpose of the ICT risk tolerance level that an entity sets under DORA?

  1. To define the maximum level of ICT risk the entity is willing to accept Correct answer.
  2. To determine employee salaries
  3. To set the price of ICT services sold to customers
  4. To choose the entity's corporate headquarters

Explanation

The risk tolerance expresses how much ICT risk the entity is prepared to accept, guiding mitigation decisions and escalation. It is a governance parameter, not a commercial or HR figure.

Question 42Fundamental concepts of ICT risk management and digital operational resilience

An entity is documenting the identification of its critical ICT assets. Which approach best supports DORA's emphasis on protecting critical functions?

  1. Mapping ICT assets and dependencies to the business functions they support, prioritising critical ones Correct answer.
  2. Documenting only assets purchased in the current year
  3. Excluding third-party hosted assets from the inventory
  4. Listing every asset with equal weight regardless of function

Explanation

Effective identification maps assets and dependencies to the business functions they support so that critical ones can be prioritised. This dependency view is what lets the entity focus resilience efforts where impact would be greatest.

Question 43Fundamental concepts of ICT risk management and digital operational resilience

Which statement best describes the role of preventive controls within DORA's ICT risk management?

  1. They are only relevant after an incident has been reported
  2. They replace the need for any detection capability
  3. They reduce the likelihood of incidents occurring, for example through patching and access control Correct answer.
  4. They are optional for entities with a low risk appetite

Explanation

Preventive controls lower the probability of incidents by hardening systems, managing vulnerabilities and controlling access. They complement detection and recovery rather than replacing them.

Question 44Fundamental concepts of ICT risk management and digital operational resilience

An entity's board asks how ICT risk management supports its digital operational resilience strategy. Which answer is most accurate?

  1. The resilience strategy replaces the need for ICT risk management
  2. ICT risk management is unrelated to the resilience strategy
  3. ICT risk management only concerns historical incident reporting
  4. ICT risk management provides the controls and processes that underpin the resilience strategy's objectives Correct answer.

Explanation

The resilience strategy sets direction, while ICT risk management supplies the concrete controls and processes that deliver it. The two are complementary, with risk management operationalising strategic resilience goals.

Question 45Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is reviewing its approach to learning from ICT incidents. Which practice best reflects DORA's expectations?

  1. Suppressing incident details to protect reputation
  2. Closing incidents once service is restored without further review
  3. Conducting post-incident reviews and updating controls and procedures based on findings Correct answer.
  4. Blaming individual staff without changing processes

Explanation

DORA expects entities to learn from incidents by analysing root causes and feeding lessons back into controls and procedures. This continuous improvement loop strengthens future resilience.

Question 46Fundamental concepts of ICT risk management and digital operational resilience

Which statement best captures how DORA treats the human and organisational dimension of ICT risk management?

  1. It requires awareness, training and a strong risk culture alongside technical controls Correct answer.
  2. It is addressed only through the annual financial audit
  3. It requires replacing all staff with automated systems
  4. It is irrelevant because only technology matters

Explanation

DORA recognises that technology controls alone are insufficient, requiring staff awareness, training and a risk-aware culture. People and processes are integral to effective ICT risk management.

Question 47Fundamental concepts of ICT risk management and digital operational resilience

An entity is assessing whether a newly identified ICT risk should be escalated to senior management. Which criterion is most consistent with DORA's governance expectations?

  1. Whether the risk was reported on a Monday
  2. Whether the risk involves a system older than two years
  3. Whether the risk was discovered by a junior employee
  4. Whether the risk could affect critical or important functions or breach the risk tolerance Correct answer.

Explanation

Escalation should be driven by the potential impact on critical or important functions and by whether the risk tolerance is breached. These are substantive criteria aligned with DORA's focus on protecting critical services.

Question 48Fundamental concepts of ICT risk management and digital operational resilience

Which statement best explains why DORA requires entities to maintain a current inventory of ICT assets and dependencies?

  1. To increase the number of documents held by the entity
  2. To enable effective identification, protection and impact assessment across interconnected systems Correct answer.
  3. To satisfy a marketing requirement for transparency
  4. To reduce the number of employees needed in IT

Explanation

A current inventory lets the entity understand its exposure, protect what matters and assess the impact of disruptions across dependencies. Without it, identification and impact assessment are unreliable.

Question 49Fundamental concepts of ICT risk management and digital operational resilience

A supervisor asks an entity to demonstrate that its ICT risk management is effective, not merely documented. Which evidence most convincingly supports this?

  1. A statement that no incidents have ever occurred
  2. A thick policy manual stored on a shelf
  3. A list of planned future improvements with no dates
  4. Records showing controls are tested, findings tracked and remediation completed Correct answer.

Explanation

Effectiveness is shown by evidence that controls operate as intended: testing results, tracked findings and completed remediation. Documentation alone does not prove that controls work in practice.

Question 50Fundamental concepts of ICT risk management and digital operational resilience

An entity identifies a risk that a widely used third-party component contains an undisclosed vulnerability. Which treatment best reflects DORA's ICT risk management logic?

  1. Assess the exposure through dependency mapping and apply mitigation such as monitoring and contingency arrangements Correct answer.
  2. Wait until the vulnerability is publicly exploited before acting
  3. Remove all documentation about the component
  4. Ignore it because the component is supplied by a third party

Explanation

Third-party components remain part of the entity's ICT risk exposure, so the entity must understand its dependencies and mitigate accordingly. Monitoring and contingency planning reduce the potential impact of an exploited vulnerability.